Critical OS Command Injection Vulnerability in Aviatrix Controllers

What changed

Aviatrix has reported a serious OS command injection vulnerability affecting its Controller software. This vulnerability arises from the improper handling of special characters in OS commands, which can be exploited by attackers.

Versions prior to 7.1.4191 and 7.2.x before 7.2.4996 are particularly susceptible, allowing unauthorized users to send crafted requests that could lead to arbitrary code execution.

Who is affected

Various users of Aviatrix Controller software are at risk due to this vulnerability. Organizations relying on this product should take immediate notice.

The following groups are particularly affected:

• Users of Aviatrix Controller versions before 7.1.4191
• Users of Aviatrix Controller versions 7.2.x before 7.2.4996
• Cloud service providers utilizing Aviatrix solutions
• Enterprises leveraging Aviatrix for network management

What to do

Organizations should prioritize updating their Aviatrix Controller to the latest versions to mitigate the risk posed by this vulnerability.

Implementing additional security measures, such as network monitoring and access controls, can further protect against potential exploitation.

• Upgrade to Aviatrix Controller version 7.1.4191 or later
• Upgrade to Aviatrix Controller version 7.2.4996 or later
• Review and enhance security protocols around API access
• Conduct regular vulnerability assessments and penetration testing